Two questions sit inside every deletion dispute: what the document said, and by what route it left. A Windows volume will normally answer both, and the second answer is the one that decides matters. Four separate records — the bin, the journal, the volume snapshots, the security log — each describe the same afternoon from a different angle, and putting them together is what turns an assertion into a timeline. Instructed by employers, solicitors and private clients across Leicestershire and the East Midlands.
◇ Authority first. Bench afterwards. The full examination, written up as a report, comes to £800 + VAT. Stop at a verified image with its deleted material extracted and nothing reported, and it is £400 + VAT — the rung a recorder disk already occupies. Diagnosis is free and the scope is agreed in writing beforehand. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are on the data recovery cost page.
Where the hour something disappeared counts for as much as what was in it, this is the page that applies.
Three quite different things get called deleting. Dragging something to the bin writes a second, smaller record alongside it, carrying where the file came from, how big it was and the minute it was moved — and that companion record habitually outlasts the bin being emptied. Holding shift bypasses the bin, but the only thing surrendered is the directory entry; the contents stay exactly where they were until something else claims the space. Overwriting a file in place is a third category altogether. Sorting out which of the three happened, and when, is generally the first thing an examination establishes, and the answer frequently says something about intention before anyone has read a word of the document.
A timeline is only worth having when more than one source supports it. The master file table keeps three times against every record it holds, whether that record is live or has been removed. The change journal writes a line for each operation as it takes place — created, renamed, deleted, extended — in the order they happened. The transaction log adds finer detail around the same few minutes. Security event logging supplies the profile that was signed in, how it signed in, and what it had been doing immediately before. Where all four line up, the hour is stated without hedging. Where they do not, the report sets out which source it relies on and gives the reason.
Windows quietly retains several earlier states of itself. Volume snapshots get written for restore points and by backup software, and each one freezes the disk as it stood on a given day: documents that were deleted later, drafts from before somebody edited them, a directory listing from three weeks back. Compare one against the volume as it is now and everything that vanished in between drops out of that one operation. No exhibit in this kind of case is cleaner — there on the Monday, gone by the following Thursday, with the journal fixing the removal to the Wednesday morning. Backup sets, the Previous Versions tab and the bin on a mapped network share all do the same job wherever they happen to exist.
Wiping software announces itself. The examination starts with what it leaves behind: entries from its installation and its removal, prefetch records that name the executable and hold as many as eight of the times it ran, the mechanical regularity an overwrite leaves on a surface, and the conspicuous absence of ordinary artefacts that any machine in daily use should have. A wipe destroys material and creates evidence in the same movement, because the tool, the hour, the account behind it and everything outside its reach all survive. Runs that were interrupted, or pointed at the wrong volume, turn up often; whatever such a run failed to touch is recovered normally and described for what it is.
Flash is the honest exception and it is worth understanding before you pay for anything. On a solid-state drive with TRIM switched on and no encryption in the way, the controller is entitled to throw away the contents of a removed file within minutes of it going, and nothing on earth reads back what the silicon has already cleared. The metadata almost always outlives it, so the fact of a deletion and the hour it happened can still be evidenced even where the document itself cannot be produced — which is frequently the half that matters. Spinning disks are kinder, though a machine in daily service chews through unallocated space steadily. And anything genuinely written over has gone, whatever is promised elsewhere. You are told which situation you are in before a quotation exists, not afterwards.
How the copy is taken and looked after is described at the forensic recovery hub. Where a removal involves a stick or a card, USB device forensics picks it up; where the whole endpoint needs taking, that is workstation deep imaging. If nobody is in dispute and you simply want files back, none of this applies and deleted file recovery is the ordinary job, priced on the bands.
Nothing here is relied on by itself. A time is asserted where these records support one another, and where they conflict the conflict is what gets reported.
Original path, size and the minute of the move, outliving the emptying itself.
Three timestamps an entry, kept for live and removed records without distinction.
One line per operation as it occurred: created, renamed, deleted, extended.
Which profile was signed in around each event, and by what kind of logon.
Volume snapshots holding what the live disk has since stopped carrying.
The tool's name, its run times, the launching account, and everything it missed.
The least popular sentence first. Forensic work does not sit under no fix, no fee. That guarantee belongs to logical recovery, and the exclusions published beside it are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench hours spent answering a question you have asked, and the hours are the same whether the answer helps your case or wrecks it. Against that, two figures are printed here rather than quoted on application, which is two more than most laboratories will commit to in public. Where the examination finishes with a full written report the fee is £800 + VAT. Where it finishes at the evidence — a verified binary image with the deleted material lifted out of it, handed to your solicitor or to another examiner to interpret — the fee is £400 + VAT. That lower figure is the same rung as a recorder disk or a BitLocker volume, so nothing on this page invents a sixth band.
The examination plus the written report it produces, set out so that an expert paid to disagree with you can follow every step and try to break it.
The verified binary image with its deleted material extracted, and no report written. The rung a recorder disk or an encrypted volume already occupies, not an extra band.
Both assume a single machine and a single question asked of it. Eleven laptops, a file server and a tenancy export is a larger exercise altogether, so anything spanning several devices is measured during the free diagnostic and written down before you are asked to agree to it. Working out what is there costs nothing and still closes 2 working days after the device is booked in at Cambridge, and the fee is settled before an examiner opens the image rather than after the findings are known. Anything that is not forensic keeps the band it has always had on the prices page.
This runs on machines the business issued, on equipment that belongs to you outright, or on a written instruction from a solicitor. Three routes reach this bench and there has never been a fourth. Kit the business bought and issued to somebody. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means owned outright or owned jointly. Nothing is broken into here. Somebody else's password is not worked out, monitoring software is not installed on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to no private laboratory. Where a client has no lawful right to look inside a device, instructing us does not manufacture one. Handsets and tablets are outside the practice altogether.
Every day a deletion case stays in service costs it something, so take the machine out of circulation before you ring 0800 689 0668 rather than afterwards. Nothing is collected anywhere in this network and there is no Leicester counter: the drive goes to Cambridge by tracked, insured post, or across the counter there in office hours. Custody opens at booking-in.
The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.
↓ Print the shipping & booking-in form (PDF)
Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.
Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.
Withdraw the machine from use, ring the freephone, and let several independent records settle the question between them.